Stored Cross-Site Scripting Vulnerability in Extendify Plugin for WordPress

CVE-2026-85679

What is CVE-2026-85679?

The Extendify plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability can be exploited by unauthenticated attackers who can inject arbitrary scripts through 'styles.blocks' Block Type Key in the plugin. The risk arises from the registerIncoming() function, which is executed before WordPress evaluates the request permissions. An attacker can send malicious POST, PUT, or PATCH requests to the /wp/v2/global-styles route, leading to script execution on pages viewed by users, thereby compromising site security.

References